Spying Using Acoustic Imaging Via Smart Devices

A team of student hackers have demonstrated a method for using music to turn smart devices into tools for spying. The system is based on sonar, and embeds an inaudible signal into songs played on a smartphone or TV. The system can then use the device’s microphone to listen to how the signal bounces, and track the movements of anyone near the audio source.

The University of Washington research team behind the technology, known as CovertBand, tested it using a 42-inch Sharp TV in five different Seattle homes.

They found that the method is able to track the physical movements of multiple people to within 18 centimeters of accuracy, and even differentiate between particular gestures and motions. The tech can also track people, though less accurately, through walls.

They also demonstrated that listeners couldn’t distinguish between songs containing the hidden sonar signals, and those without it. ...and all CovertBand needs to work is a speaker and a microphone. more

Smartphone Replacement Parts as Spies

If cracking your smartphone’s touchscreen wasn’t bad enough, researchers have found out a new security threat that might emerge out following the replacement of your touch screen as it has been found out that the replaced units might contain hardware that could hijack a device. 

A paper presented by researchers at Ben-Gurion University of Negev, Israel, at the 2017 Usenix Workshop on Offensive Technologies, shows how smartphone replacement units can be a security risk for the user.

Click to enlarge.

According to the researchers, devices with cracked touchscreens or even other damaged components are prone to security risks as the replaced parts installed by a repair shop might contain additional hardware that can hijack the device and track usage, log keystrokes, install other malicious apps, access files and more. more

Dude, No Kid Uses a Landline Phone Anymore

MI - A heads up for parents! 

Cue theme music.

You might not know it, but you could end up in jail for eavesdropping on your child's conversations from a landline phone.

So many parents might pick up another line in the house to see who their child is talking to, but listening in on a call is a felony punishable by up to two years behind bars and a $2,000 fine.

However, a Republican lawmaker wants to change that. State Representative Peter Lucido (R-Shelby Township), introduced a bill last week that would give parents exemption from the eavesdropping law. more 

Idea! How about a law against loitering in phone booths.

So You Named Your Robot Bedmate, Mata Hari. Cute.

At the Hack in the Box security conference later this week in Singapore,

Argentinian security researchers Lucas Apa and Cesar Cerrudo plan to demonstrate hacker attacks they developed against three popular robots: the humanoid domestic robots known as the Alpha2 and NAO, as well as a larger, industrial-focused robotic arm sold by Universal Robots.

The duo plan to show that they can hack those machines to either change critical safety settings or, in the case of the two smaller bots, send them whatever commands they choose, turning them into surveillance devices that silently transmit audio and video to a remote spy.

"They can move, they can hear, they can see," says Cesar Cerrudo, the chief technology officer of IOActive, where both of the researchers work. Those features could soon make robots at least as tempting a target for spies and saboteurs as traditional computers or smartphones, he argues. "If you hack one of these things, the threat is bigger."...

Privacy invasion presents a more realistic worry... domestic robots contain mobile cameras and microphones whose data a spy could not only intercept, but manipulate and move at will around a target's house.  more

Do Bug Detecting Gadgets Work? Let's Ask an Ex-Police Chief

CA - A judge set bond at $100,000 on Friday for former La Joya police Chief Geovani Hernandez, who’s accused of accepting cash to provide security for drug shipments... When agents arrested Hernandez, they found a “bug detector” designed to reveal hidden recording devices and prevent electronic surveillance. more

TSCM News: All Blacks Bugging Case Settled

Australia - Adrian Gard, the security consultant at the centre of the All Blacks bugging case, had his public mischief charge dismissed by a Sydney court on Friday.

Gard was accused of making a false statement to police about a listening device found in the All Blacks’ hotel meeting room before the August 2016 match against Australia in Sydney.

The magistrate was unable to rule out that someone else could have planted the bug.

Gard was found guilty of a second charge relating to carrying out a security operation without a license.

The matter, dubbed “bug-gate”, caused much friction between the Australian and New Zealand Rugby unions when it was revealed last year. more

Moral of the story... This all could have been avoided if the All Blacks spent the money to hire a real, reputable (and licensed) technical security consultant. ~Kevin

PI Alert: New NY Law Reduces Surveillance Opportunities

Spying on your neighbor's backyard barbecue with video surveillance is now illegal in New York.

Gov. Andrew Cuomo has signed a bill cracking down on the unauthorized invasion of privacy by video surveillance in the backyard... Unlawful surveillance was made a crime in 2003, but it only applied to places where there's an expectation of privacy like bathrooms and dressing rooms. more


PS - Law enforcement surveillance is exempted under the new law.

Spycam Darwin Award of the Week - The Creepy Kid

Jeremy Gabrysch put up a camera in their living room because his kid kept getting up in the middle of the night to watch TV.


The kid was not to be deterred, even if he didn't quite understand how a wide-angle lens works. more

Good Spy News - Mom Bugs Kids... but not the way our moms did it.

California law makes it a crime to record someone’s conversation secretly, with a few exceptions — and one of them, a state appeals court says, allows a parent to use a hidden cell phone to record her child’s talks with a babysitter suspected of abuse.

A mother’s recording led to the conviction of a 12-year-old babysitter for molesting his 4-year-old cousin. The defense lawyer argued that the recording was illegal because neither of the speakers had consented.

But the Fifth District Court of Appeal in Fresno said Monday that a parent who reasonably fears harm to her child, particularly a young child, can consent to a secret recording on the child’s behalf. State law normally requires the consent of both parties to a conversation, but allows consent by one person who reasonably suspects the other of a serious crime. more

SCIFs Go Corporate

With cybersecurity threats on the rise, the private sector is taking a cue from national security protocol to protect corporate secrets, investing in highly protected SCIFs, or Sensitive Compartmented Information Facilities.

What happens in a SCIF stays in a SCIF—and has ever since the concept of the “war room” originated during World War II. ...

Private companies are increasingly seeing the benefits too—especially those working in fields whose success is dependent on continually out-innovating their competitors. “The rooms can be used in many ways once built, from proposal writing and strategy sessions, to hands-on R&D and product testing,” says Gordon. “They can even be portable. But they all give companies piece of mind that work and discussions taking place inside the room are completely confidential.” more

Can't afford a SCIF (they're expensive), use a TSCM team to conduct pre-meeting inspections. If you can afford a SCIF (sweet), use a TSCM team to re-certify it's integrity against eavesdropping. SCIF effectiveness tends to decay with age and use. ~Kevin

Security Director Alert #857 - Coordinated Hotel Wi-Fi Spying

Mention this to your traveling executives. Reinforce VPN usage.
 
Russian hackers who infiltrated the computer systems of the Democratic National Committee in the US are now focusing on the wifi networks of European hotels to spy on guests in a “chilling” cyberoperation.

The state-sponsored Fancy Bear group infected the networks of luxury hotels in at least seven European countries and one Middle Eastern country last month, researchers say. FireEye, the US cybersecurity company that discovered the attacks, said the hotels were in capital cities and belonged to international chains that diplomats, business leaders and wealthy travelers would use. more

A TSCM Cautionary Tale - The All Blacks Affair

Background... A security consultant for the All Blacks rugby team announces he found a bug in a meeting room chair seat cushion. The arrest. And now, the trial...

An upholsterer called as a witness in the All Blacks bugging trial told a Sydney court he didn’t find any evidence of “tampering” or “reupholstering” when he inspected a chair allegedly used to conceal a listening device in the lead up to the Bledisloe Cup.

All Blacks security consultant Adrian Gard has denied making up claims he found the bug concealed in a chair in the All Blacks’ meeting room at the InterContinental Hotel in Double Bay in August 2016.

Mr Gard has pleaded not guilty to making a false representation resulting in a police investigation into the bug...

All Blacks team manager Darren Shand told the court last week Mr Gard on August 15, 2016, showed him two chairs which he claimed had given off abnormal readings during a bug sweep in the meeting room. Mr Shand said he could see what looked like a listening device. more

Why should you care?
• Not all TSCM "experts" are honest. (I'm shocked!)
• Reputation and experience matters.
• Ignore the smooth talk. Check references thoroughly, before letting them in.
~Kevin

This just in... The bugging device found in a chair in the All Blacks' Sydney hotel is sold at a chain of spy stores, a court has heard. Technician Mark Muratore told Downing Centre Local Court on Wednesday the FM transmitter powered by a nine-volt battery was sold at the Oz Spy chain of stores and on eBay. Mr Muratore told the court about 80 of the FM transmitter devices, known as the RBFM600, were sold each year on eBay and at Oz Spy for $120 (≈$95 usd) each.

This Month in the Internet Disaster Incidents of Things (IDIoT)

Instant Lockdown...
Hundreds of Internet-connected locks became inoperable last week after a faulty software update caused them to experience a fatal system error, manufacturer LockState said. The incident is the latest reminder that the so-called Internet of Things—in which locks, thermostats, and other everyday appliances are embedded with small Internet-connected computers—often provide as many annoyances as they do conveniences. more
---
Fish Tank Phishing...
The hackers attempted to acquire data from a North American casino by using an Internet-connected fish tank, according to a report released Thursday by cybersecurity firm Darktrace.

The fish tank had sensors connected to a PC that regulated the temperature, food and cleanliness of the tank.“Somebody got into the fish tank and used it to move around into other areas (of the network) and sent out data,” said Justin Fier, Darktrace’s director of cyber intelligence. more
--- 
Flatline Surfing
Over a third of IoT medical device organizations suffer security incidents... Many medical devices are not built with cybersecurity in mind, yet a survey by Deloitte Cyber Risk Services of over 370 professionals organizations operating in the medical device/IoT arena shows that 36.5 percent have suffered a cyber security incident in the past year. more
---
Wait! What? You mean they are not secure!?!?
The Department of Homeland Security (DHS) has announced a $750k investment to develop a solution which bolsters the security of IoT disaster sensors. more
---
This Really Sucks
iRobot, the company that makes the adorable Roomba robots that trundle around your home sucking up everything in their path, has revealed its plans to sell maps of living rooms to the world's biggest tech companies. more
---
Car Wash Crazies
A group of security researchers have exposed the vulnerabilities in automatic car washes and proved just how easy it can be for hackers to target an internet-connected, drive-through car wash and damage vehicles. Their findings showed an attacker could easily manipulate bay doors to trap or strike vehicles in the car wash. Their findings showed an attacker could easily manipulate bay doors to trap or strike vehicles in the car wash. Hackers could also potentially control the mechanical arms inside the car wash, releasing powerful streams of water at a vehicle’s doors to prevent passengers from leaving. more
---
IoT Army MIA
In a competition between 24 skilled cyber amateurs, IoT connected soldiers were hit by a sophisticated mock cyber attack. ...designed to secretly intercept and control communications, resulting in a loss of contact with the unit of soldiers. more
---
Security Camera Insecurity times Millions
A flaw in a widely-used code library known as gSOAP has exposed millions of IoT devices, such as security cameras, to a remote attack. Researchers at IoT security firm Senrio discovered the Devil's Ivy flaw, a stack buffer overflow bug, while probing the remote configuration services of the M3004 dome camera from Axis Communications... Axis Communications confirmed that 249 of its 251 surveillance camera models were affected by the flaw. more
---
Alexa. My Wife Never Listens. Will You?
Every good paranoiac sees an always-listening device like an Amazon Echo as a potential spy sitting in plain sight. Now one security researcher has shown exactly how fine the line is between countertop computer and surveillance tool. With just a few minutes of hands-on time, a hacker could turn an Echo into a personal eavesdropping microphone without leaving any physical trace. more
---
FutureWatch - Soon ALL organizations will need a good Technical Security Consultant on-call. Periodically checking for new unintentional (and intentional) security vulnerabilities is their specialty. ~Kevin

Researchers: 'Stingray' Detector Apps - Not 100% Effective

Academic researchers at Oxford University and the Technical University of Berlin found that several leading Android apps designed to detect when a phone connects to a fake cell site, known as a "stingray," can be easily bypassed, allowing the stingray owner to eavesdrop on calls, intercept messages, and track the precise location of a phone.

The researchers found that the top five stingray detection apps in the Google Play app store -- SnoopSnitch, Cell Spy Catcher, GSM Spy Finder, Darshak, and AIMSICD -- failed on at least one count to alert the phone owner when their device has connected to a fake cell site...

The paper was released Monday ahead of a presentation at the Usenix Woot conference in Vancouver, Canada. more

Security Director Alert # 522 - Spying USB Power Plugs & Charging Cables

Freely for sale on Amazon's marketplace, and plenty of other online stores, are USB and iPhone cables that can be used to listen to your phone calls and track your location.

When these cables are connected to a power source they can use a SIM card to connect to a mobile network. The hardware is unsophisticated but can send both audio and very coarse location data to a third-party...

A more worrying feature is the ability of the cable to detect sound over a certain threshold and then call a pre-programmed number. Once it has done this is relays the sound near it, be that a phone call or conversation, and allows a third-party to listen in.

Not only are there cables that do this, there are also USB power adaptors for your wall outlet that have the same SIM functionality.

Cables and power adapters like this should also be something of a worry to firms that need their security too, they may well not be noticed by security checks and could be responsible for a lot of sensitive information walking out the front door. more

Best Practice: Include the inspection of cables and charging blocks as part of your TSCM inspections.